What Is Soar

SOAR (acronym that stands for Security Orchestration, Automation and Response) refers to a set of compatible software programs that allows an organization to collect threat data and respond to security events in an automated way. The objective of using a SOAR platform is to improve the efficiency of security operations.

As the name suggests, SOAR programs are composed up of three main elements:

1. Orchestration;
2. Automation;
3. Security response.

SOAR usually connects multiple internal and external tools through integrated modes and Application Program Interfaces (APIs). These connected systems often include vulnerability scanners, endpoint protection products, end-user behavior analytics, firewalls, intrusion detection and intrusion prevention systems (IDS/IPS), as well as Security Information and Event Management (SIEM) platforms.

With all the data collected by these systems, companies can have a better chance of detecting threats and achieve better levels of collaboration between teams.